CVE-2025-10835: Pet Grooming Management SQLi Vulnerability

CVE-2025-10835 Overview

CVE-2025-10835 is a SQL injection vulnerability in SourceCodester Pet Grooming Management Software 1.0, developed by Mayurik. The flaw resides in the /admin/view_payorder.php file, where the ID parameter is not properly sanitized before being passed to the underlying SQL query. Remote attackers with low-privileged authenticated access can manipulate the parameter to inject arbitrary SQL statements. The exploit details have been disclosed publicly, increasing the likelihood of opportunistic attacks against exposed installations. The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output).

Critical Impact
Authenticated remote attackers can manipulate the ID parameter on /admin/view_payorder.php to execute arbitrary SQL against the application database, exposing stored customer and order data.

Affected Products

Mayurik Pet Grooming Management Software 1.0
SourceCodester distribution of Pet Grooming Management Software
CPE: cpe:2.3:a:mayurik:pet_grooming_management_software:1.0

Discovery Timeline

2025-09-23 - CVE-2025-10835 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-10835

Vulnerability Analysis

The vulnerability exists in the administrative view of payment orders. The view_payorder.php script accepts an ID parameter from the HTTP request and concatenates the value directly into a SQL query. Because the input is not sanitized or bound as a parameter, an attacker can supply SQL fragments that alter query logic. Successful exploitation allows extraction of database contents, modification of records, or enumeration of schema details. The attack requires low-privileged authentication but can be initiated remotely over the network. Public availability of the proof-of-concept lowers the barrier for exploitation.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-74]. The application passes user-controlled input from the ID parameter directly into the SQL statement without using prepared statements, parameterized queries, or input validation routines. This classic SQL injection pattern occurs when developers concatenate request variables into queries rather than binding them as parameters.

Attack Vector

The attack vector is network-based. An authenticated attacker sends a crafted HTTP request to /admin/view_payorder.php with a malicious payload appended to the ID query parameter. Typical payloads include UNION SELECT statements to read arbitrary tables, boolean-based blind injection to infer data character-by-character, or time-based payloads using SLEEP() to confirm injection. Technical details for the proof-of-concept are available in the GitHub SQL Injection Report and the VulDB CTI #325192 entry.

Detection Methods for CVE-2025-10835

Indicators of Compromise

HTTP requests to /admin/view_payorder.php containing SQL keywords such as UNION, SELECT, SLEEP, BENCHMARK, or comment sequences (--, /*) in the ID parameter.
Web server access logs showing unusually long or URL-encoded values for the ID query string parameter.
Database error messages referencing syntax errors originating from the view_payorder.php endpoint.
Anomalous spikes in database query duration or row counts returned to the application user associated with the admin panel.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that inspects the ID parameter on /admin/view_payorder.php for SQL metacharacters and known injection signatures.
Enable database query logging and alert on queries originating from view_payorder.php that contain tautologies such as OR 1=1 or stacked queries.
Correlate authentication logs with access patterns to the admin module to identify compromised low-privilege accounts being used for injection attempts.

Monitoring Recommendations

Monitor outbound traffic from the web server for unexpected database dumps or large response payloads tied to the admin endpoint.
Track failed and successful login attempts to the admin interface and alert on credential reuse from new IP ranges.
Forward web server, application, and database logs to a centralized analytics platform for cross-source correlation of injection attempts.

How to Mitigate CVE-2025-10835

Immediate Actions Required

Restrict network access to the /admin/ directory using IP allow-lists or VPN-only access until a fix is available.
Audit existing administrative accounts and rotate credentials, removing any accounts no longer required.
Deploy WAF signatures that block SQL injection patterns targeting the ID parameter on view_payorder.php.
Review database logs for prior injection attempts and assess potential data exposure.

Patch Information

No official vendor patch has been published for CVE-2025-10835 at the time of writing. Operators should consult the SourceCodester Security Resources page for vendor updates and the VulDB #325192 entry for tracking remediation status. In the interim, source-level mitigation requires modifying view_payorder.php to use parameterized queries via PDO or mysqli prepared statements.

Workarounds

Replace string concatenation in view_payorder.php with parameterized SQL queries using PDO::prepare() and bindParam().
Validate that the ID parameter is strictly numeric before passing it to the database layer using intval() or filter_var($id, FILTER_VALIDATE_INT).
Apply principle of least privilege to the database account used by the application, removing schema modification rights.
Disable or remove the view_payorder.php endpoint if it is not required for business operations.

bash

# Example WAF rule (ModSecurity) to block SQL injection on the ID parameter
SecRule REQUEST_URI "@contains /admin/view_payorder.php" \
    "chain,phase:2,deny,status:403,id:1010835,msg:'CVE-2025-10835 SQLi attempt'"
  SecRule ARGS:ID "@rx (?i)(union(\s|\+)+select|sleep\s*\(|benchmark\s*\(|--|/\*|or\s+1=1)" \
    "t:none,t:urlDecodeUni"